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We propose a practical quantum cryptographic scheme which combines high information capacity, such as 
provided by high-dimensional quantum entanglement, with the simplicity of a two-dimensional Clauser-Horne- 
Shimony-Holt (CHSH) Bell test for security verification. By applying a state combining entanglement in a 
two-dimensional degree of freedom, such as photon polarization, with high-dimensional correlations in another 
degree of freedom, such as photon orbital angular momentum (0AM) or path, the scheme provides a consid¬ 
erably simplified route towards security verification in quantum key distribution (QKD) aimed at exploiting 
high-dimensional quantum systems for increased secure key rates. It also benefits from security against collec¬ 
tive attacks and is feasible using currently available technologies. 


I. INTRODUCTION 

Cryptography is one of the most promising applications of 
quantum science m. With the recent demonstrations of high¬ 
dimensional two-photon entanglement using time bins Elia 
and OAM dia, large-alphabet entanglement-based quantum 
key distribution (QKD) systems become closer to their real- 
world implementations and applications. The traditional ap¬ 
proach to large-alphabet QKD based on Bell’s theorem in¬ 
volves encoding a key in a high dimensional degree of free¬ 
dom, such as photon OAM, and verifying the security of the 
generated key using a test of a Bell inequality which requires 
projective measurements in high-dimensional mutually unbi¬ 
ased bases O . This is a straighforward generalization of the 
original protocol introduced by Ekert in 1991 (E91) fnia and 
its modifications, such as proposed in Ref. El. 

E91-based protocols have been demonstrated for qubits us¬ 
ing polarisation and using time-energy entanglement Co). 
A Bell-type test of energy-time entangled qutrits has also been 
realised ifTTl . Reported Bell-test-based QKD experiments us¬ 
ing OAM qutrits have implemented a randomized selec¬ 
tion of dichotomous measurements instead of full projective 
measurements in a 3-dimensional state space. Although pro¬ 
jective measurement for detection of high-dimensional OAM 
states of light with up to 11 different outcomes is now within 
reach (TS) HU, it still remains an experimental challenge to 
perform them in arbitrary qudit bases. In the case of high¬ 
dimensional time-bin states, such unitary operations would 
require multi-path interferometric setups which become too 
cumbersome to implement for a high number of dimensions. 
Although a scheme for large-alphabet QKD has been pro¬ 
posed and realized using energy-time entanglement ifTSll . the 
applicability of this scheme is specific to this kind of entangle¬ 
ment and the security verification is highly device dependent 
as it places stringent conditions on timing resolutions of the 
detectors, which limits key generation rates. 

Security verification of quantum key distribution schemes 
is a complicated problem in general. Security proofs have 
been provided for Bell-test-based QKD against the so-called 
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collective attacks ca as well as the most general coherent at¬ 
tacks in the standard security scenarios fTH . However, proofs 
of device-independent security against these sophisticated at¬ 
tacks are not yet available in the case of entangled qudits re¬ 
quiring Bell tests generalised to high-dimensions f\M . 

Here, we propose an approach to large-alphabet 
entanglement-based QKD which circumvents these problems 
by avoiding the need to perform high-dimensional unitary 
rotations required for measurements in different mutually 
unbiased bases, resulting in a much simplified measurement 
setup. The scheme presented here also benefits from security 
proofs for QKD based on entangled qubits against collective 
attacks. Our approach is in principle applicable to any system 
in which it is possible to create bipartite two-dimensional 
entanglement in one degree of freedom and high-dimensional 
correlations in another. Although we will use an example 
with photon polarization and OAM to illustrate the protocol, 
the principle can be applied to other systems using other 
degrees of freedom to encode large secret keys. 

The very essence of large-alphabet QKD is the possibil¬ 
ity of a large rate of key generation. In practice, for a given 
entanglement-based QKD system, the minimum applicable 
coincidence detection time window At is an important factor 
limiting the maximum rate at which it is possible to generate 
secure keys per run, i.e., a single transmission and detection 
of the source state. The higher the number of dimensions of¬ 
fered by the source state, the higher the maximum possible 
key rate per run for a given At. The development of OAM 
sorters makes genuine large-alphabet key generation using up 
to 11-dimensional OAM entanglement feasible. This will also 
allow for a higher data rate per photon pair, as the detec¬ 
tion of the photonic qudits would not need to be implemented 
as (probabilistic) dichotomous measurements as has been the 
case in previous experiments El Ha. It is also straightfor¬ 
ward to implement projective measurements in computational 
(unrotated) time-bin bases. In what follows, we will first de¬ 
scribe the existing generalizations of the E91 protocol. We 
will then describe the source state, measurement setup, and 
security considerations for our proposed scheme. Einally, we 
will conclude with a few remarks on the realizability of the 
proposed experimental implementations. 
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II. GENERALIZED E91 PROTOCOL 

To establish our scheme, let us hrst review the basic 
entanglement-based large-alphabet QKD resulting from a di¬ 
rect generalization of the E91 protocol and its variants. As¬ 
sume a source producing photon pairs in the state 

= ( 1 ) 

j=0 

Here we use the notation \x,y) = \x) 0 \y), where (g) denotes 
tensor product. In terms of 0AM eigenstates \£) for example, 
this may be written as the maximally entangled state 

i=^d/2] 

\^) = Td I (2) 

i=-[d/2] 

where h{i) = 1 for ah i when d is odd, and h{i 7 ^ 0 ) = 1 , 
h{0) =0 when d is even. 

In a Bell inequality test experiment, each of the commu¬ 
nicating parties ‘Alice’ (A) and ‘Bob’ (B) will have a pho¬ 
ton 0AM detector with D outcomes per setting and two set¬ 
tings/measurements: {Ai, A 2 } and B 2 } respectively, 
which maximize Bell inequality violation. For the QKD 
scheme, there is an additional setting for each detector, i.e., 
A 3 for Alice and for Bob, chosen to produce perfect corre¬ 
lations. In a variant of Ekert’s scheme modihed for increased 
key generation efficiency [H [T71 [HI, only Alice’s detector 
uses an additional setting, i.e., Aq, which is chosen to pro¬ 
duce perfect correlations when Bob measures with setting Bi 
for the purpose of key generation. Although our scheme is di¬ 
rectly applicable to this higher-efficiency version, we mainly 
illustrate here using Ekert’s scheme for clarity. Alice and Bob 
independently choose their settings at random and also note 
their detection results independently. After sufficiently many 
measurement runs, Alice and Bob perform basis reconcilia¬ 
tion through one-way classical post processing fjol. followed 
by privacy amplihcation on the raw key. 

When the combination {A^^B^} (or {Ao,5i}) is selected 
by Alice and Bob, the measurement results are used for the 
secret key as they are perfectly correlated on both sides. To 
determine the security of this key, the correlation in the rest 
of the data will be checked for eavesdropping through a Bell 
inequality test, for example using Bell inequalities gener¬ 
alised to J-outcomes per measurement proposed by Collins 
et al. 1211 . equivalent to the CHSH-Beh inequality fT2\ when 
d = 2. Only cases in which the combination of measurement 
settings involve A 1^2 and B 12 are used for this test, while the 
remaining results are discarded. After basis reconciliation. 
Bob announces his data for the Bell inequality check, and 
Alice computes the value of the Bell parameter S. If S > 2, 
then the key is secure and the eavesdropper. Eve, will not have 
gained any useful information on the key. The secret key can 
then be used in any cryptographic communication between 
Alice and Bob. 

Implementing the above requires full projective measure¬ 
ments in the 0AM state basis {|^)} in a J-dimensional sub¬ 
space, corresponding to This may be realized, e.g. for 


up to J = 11 using 0AM mode sorters as mentioned above. 
However, full projective measurements whose operators have 
eigenstates which are 0AM superpositions are also required. 
It is nontrivial to realize such measurements because it re¬ 
quires a unitary operation within the high-dimensional 0AM 
subspace being considered before the 0AM detection. The 
implementations of such operations are difficult to derive in 
general, and have not yet been realized experimentally. 

III. PROPOSED SCHEME 
A. State preparation 

We propose a state which replaces the need for measure¬ 
ments in high-dimensional rotated bases with the simplicity 
of a two-dimensional CHSH Bell test for the verihcation of 
the security of generated key. To appreciate how our source 
state relates to hybrid entangled states, consider the state ex¬ 
pressed in terms of the composite 0AM and polarisation basis 
states \i^P) (where i denotes the 0AM, £ = — 00 ^..., ^-cx); and 
P denotes the prolarization P = H,V) sls 

. n=+[d/2] 

= ^ I \2n,H)^\-2n,H)s 

v2d „=_[j/2] 

+ \2n-l,V)^\-2n+l,V)^, (3) 

with ^ / 0 for even d. Note that this state combines 2d- 
dimensional orbital angular momentum entanglement and po¬ 
larization entanglement in a way similar but quite different 
from the cases of the so-called hyper-entangled ||23l. hypoen- 
tangled 1^ or entangled entangled tISl states. In hyper¬ 
entanglement, a measurement of 0AM will not destroy po¬ 
larization entanglement and vice versa. In hypoentanglement, 
measuring either polarization or 0AM destroys entanglement 
in the other degree of freedom. Here measuring 0AM com¬ 
pletely destroys polarization entanglement, but the converse 
is not true. We note that the division of the subspaces (e.g. 
into odd and even 0AM parities in this example) can also be 
done in other ways, depending on the specihc realization and 
experimental convenience. State ^ can be rewritten, as 

I n=[d/2] 

|^e) = ^ Y, |0)n, W 7^0 for even (4) 

vd n=-[d/2] 

Here is an entangled state within the ^th 0AM subspace. 
Although this state is (hypo)entangled in both polarization 
and 0AM, only the classical correlation in 0AM is strictly 
necessary for our scheme. 

Source state: Our source state is of the form 

n=[d/2] 

10'’/°= (g) ( 5 ) 

n=—[d/2] 

P /D 

Where \(l))n is an entangled state in polarisation within an 
0AM subspace specihed by n. The source state could be ob¬ 
tained either by post-selection or deterministically (denoted 
by superscripts P and D respectively) as outlined below. 


3 


(a) State preparation (post-selective case) (b) Measurement (post-selective case) 



FIG. 1. (Color online) Schematic diagram for a suggested implementation of the proposed simplified large-alphabet entanglement-based quan¬ 
tum key distribution using 0AM and polarization, (a) Preparation of the two-photon state jOg) [Eq. 0] or [Eq. j8}] using spontaneous 
parametric down conversion (SPDC) in a /3-barium borate (BBO) nonlinear crystal cut for type-I spontaneous parametric down conversion. 
The preparation uses an 0AM parity sorter GU, a polarizing beam splitter (PBS) and a non-polarising 1:1 beam splitter (BS). (b) Measurement 
setup for Alice (Bob). Measurements 1, 2, and 3 i.e., Aj and (j,k= 1,2,3) are respectively selected randomly (e.g., using beam splitters) 
on Alice’s and Bob’s side. For the Bell test, Alice (Bob) adds (subtracts) h of 0AM for vertically polarised photons using PBSl, SEMI 
(OAMdil) and PBS2. Then Alice (Bob) sets the half-wave plate (HWP2) orientation angle to implement the randomly chosen measurement 
{AilBi or A 2 IB 2 ). HWP2 and PBS3 are used for polarization analysis in the Bell-test, after which Alice (Bob) may then choose to reverse 
the first operation by using SLM2 (0 AM=f 1) and PBS4. 0AM sorting Gii is used to resolve the qubit subspaces and/or establish the key 
(measurement 3). 


1. State preparation: Post-selective case 

Suppose we define 

|(/.)P = {\Ha,Hb), + \Va,Vb),) /y/2, where (6) 
\HA,HB)^ = \2n,H)^®\-2n,H)g 
\HA.VB)^ = \2n,H)A®\-2n+\,V)s 
\VA,HB)n = \^n-\,V)A®\-2n,H)s 

I Va , = |2n - 1, y )a ® I -2« + 1, V)b. (7) 

Note that this state is a combination of d photon pairs, 
with each pair hypoentangled in both polarisation and 0AM 
in unique 0AM subspaces. 

A source state for our scheme [of the form Eq. Q] could 
be obtained by post-selection from 

\^i) = |<l>e)®^ (8) 

which is a product state of d pairs of OAM-entangled photons 
where \^s) is the two-photon state expressed in Eq. 0. A 
proposed scheme to obtain from common spontaneous 

parametric down conversion (SPDC) sources is illustrated in 
Fig. [TJa). This involves generating 0AM entanglement by 
type-I collinear parametric downconversion with a defined po¬ 
larization, say horizontal (|F/^)). The co-propagating photon 
pairs entangled in 0AM are passed through an 0AM parity 
(even/odd) sorter mu. A half-wave plate is then inserted after 
one of the output arms which rotates \H) to vertical polar¬ 
ization |y), coupling 0AM parity to polarization. The state 
represented in Eq. could then be generated by choosing 
parameters of the SPDC source to create more than one en¬ 
tangled photon pair simultaneously. It is well known that a 
desired probability of multiple pair generation per pump pulse 
can be achieved according to the theoretical J-pair creation 
probability l26l 

Pd = id+l) sech"^ ( t) taia^ ( t) , (9) 


where T is a real-valued coupling coefficient which is propor¬ 
tional to the product of the pump amplitude and the coupling 
constant between the electromagnetic field and the nonlinear 
crystal. The source state for our scheme can then be obtained 
by final postselection on state represented by Eq. This 
can be done by registering only the values of n for which 
both Alice and Bob have a single detection each per 0AM 
subspace in one run. To achieve this, it suffices to use de¬ 
tectors which distinguish between zero, one, and more than 
one photon. Such detectors have been experimentally demon¬ 
strated (271 EH- Also, actual photon-number-resolving de¬ 
tectors have been realised (e.g., see (29l[30l) with increased 
detection efficiencies (211. 


2. State preparation: Deterministic case 

A more suitable approach, however, is to prepare the source 
state in a deterministic way by, e.g., using an array of d 
polarization-entangled-photon sources (EPS) generating ex¬ 
actly one photon pair at a time. Existing semiconductor quan¬ 
tum dot (QD) systems provide a suitable platform for single 
photon generation (32l [33l, as well as generation of entan¬ 
gled photon pairs on demand with high efficiency (34l . Rapid 
experimental progress is also being made towards implement¬ 
ing arrays consisting of several QD high-fidelity-entangled- 
photon-pair emitters on the same chip (35l . Here, we propose 
a setup utilising d EPS (see Pig. [^. 0AM of ^ for ex¬ 
ample, is then individually imprinted on photons emitted by 
the source to yield state \(j))n, resulting in basis states that 
are assigned as shown below. The photons in an entangled pair 
are usually generated using the biexciton-exciton-vacuum cas¬ 
cade, and are separable based on their wavelength. Individual 
photons from different pairs may then be combined into one 
beam using an 0AM combiner (i.e., a coherent 0AM sorter 
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operated in reverse) to obtain the source state [Eq. • 0 ]. 
For this case, the entangled state within the n\h subspace 
defined as 

= {\HA,HBy„ + \VA,VBy„) /\/ 2 , where ( 10 ) 
\HA,HBy, = \n,H)^®\n,H)^ 

\HA,VB): = \n,H)A®\n,V)j, 

\VA,HBy„ = \n,V)A®\n,H)s 

\VA,VByn = \n,V)A^\n,V)s- dD 


We note that the source state[Eq.[^ is essentially the same 
for both the probabilistic and deterministic preparations ex¬ 
cept for a change in the basis state assignment of the 0AM 
measurement. This basis selection is simply for the con¬ 
venience of experimental implementation specific to each 
method of state preparation. 


B. Measurement settings 


As in the standard case for the generalised E91 protocol 
described in Section |I^ our scheme using the state ^ also 
involves three measurement settings randomly and indepen¬ 
dently chosen by Alice and Bob. However, the settings Ai 2 
and Bi 2 are now achieved using polarization measurements 
for maximal CHSH-Bell inequality violation. These mea¬ 
surement settings each have two outcomes “+” and For 
key generation, A 3 and (or Aq and ^i) are the same as 
described above. An important aspect of our scheme is to 
perform both key generation and Bell tests individually in 
each nih subspace (or channel), and simultaneously for all 
n= 1,..., J, using the same Bell-test setup. 


1. Measurement: Post-selective case 


To achieve the simultaneous measurements for the case 
of the non-deterministic state preparation outlined in Sec¬ 
tion IIIlXT] above, Alice and Bob need to first perform local 


operations which make the respective 0AM states degener¬ 
ate for orthogonal polarisations of Alice’s and Bob’s photons 
within each nih subspace, i.e., to disentangle the polarisation 
and 0AM degrees of freedom. This can be achieved if, e.g., 
Alice (Bob) subtracts (adds)/i of 0AM for the vertically po¬ 
larised photons [using the combination of PBS 1, SEMI and 
PBS2 in Fig.[2(b)]. This operation by Alice and Bob can be 
described by the transformations Qa and Qb where 


d 

Qa='£ \2n,H}A2n,H\^ + \2n,V)A{^n-hV\A (12) 

n=l 

d 

Qb=Y. |-2n,H)5(-2n,//|5+|-2n,y)g(-2n-l,y|5. 

n=\ 


Note that this only causes a transformation of the basis states 
defined in Eq. 0 as follows, 

\Ha,Hb)„ \HA,HB)y = \2n,H)A®\-2n,H)B, 

\HA,VB)n \HA,VB)y = \2n,H)^®\-2n,V)B. 

\Va,Hb)„ \VA,HB)y = \2n,V)A®\-^n,H)s, 

\Va,Vb), IVaVb)? = \2nA)A®\-^n,V)B- (13) 

A combination of a HWP and a PBS can now carry out the 
Bell-test polarisation measurements (A 12 or 5 12 ) for each 
value of n. 

We can write the CHSH inequality in the ^th subspace as 


Sn = En{Ai,Bi) -Eyi{Ai,B2) ^En{A2,Bi) ^En{A2,B2) < 2 , 

(14) 

where the correlation coefficients of the measurement A/ per¬ 
formed by Alice and Bj by Bob are defined as 

En{Ai,Bj)=Pn{Ai=Bj)-Pn{Ai^Bj). (15) 

Pn{Ai = Bj) and P^(A/ 7 ^ Bj) are probabilities for equal and 
unequal outcomes respectively, determined experimentally 
using the coincidence rates within each ^th subspace. The de¬ 
tector settings for the CHSH Bell inequality violation could be 
specified as measurements in the bases {|m+( 0 )), |m_( 0 ))}, 
where 

|m+( 0 )) =-cos( 20 )|± 2 ^,if) + sin( 20 )|± 2 ^,y), 
|m_( 0 )) =sin( 20 )|± 2 ^,if) -fcos( 20 )|± 2 ^,y). (16) 

In the ± sign above, applies to Alice and ’ applies to 
Bob. A half-wave plate oriented at an angle 6 rotates the 
measurement basis of a polarizing beam splitter (PBS) i.e., 
{|^)> V)} to {\m+{e)),\m-{e))}. If we set 

ef = 0 , e^ = 7r/8, ef = ;r/16, and = 3;r/16 (17) 

as values of 0 for Ai,A 2 , 5 i and B 2 respectively so that Alice 
and Bob always measure in bases which are mutually unbi¬ 
ased with respect to each other, then we will ensure the com¬ 
mutativity of Alice’s and Bob’s measurement outcomes and 
get the maximal violation of 2s/2 for each ^th subspace of 
state 0 . Using the basis notation defined above [Eq. •ED], 
the corresponding Bell operator 136^38]! can be written as 

Sn =^/ 2 ( \HA,HB)y {HA,HB\y+\VA,VB)y {VA,VB\y 

+\HA,HB)y {VA,VB\y+\yA,VB)y {HA,HB\y 
- ihaAb)^ {HAMy-\yA,HB)y {VA,HB\y 
+ \HAAB)y + Va,//b )2 {HAAB\y). (18) 

Obtaining the statistical data for the Bell test requires either 
carrying out a detection which resolves both polarisation and 
0AM or, as illustrated in Figure (b), reversing operation 
Qa/b to re-establish OAM-polarisation entanglement (using 
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(a) State preparation (deterministic case) 


(b) Measurement (deterministic case) 


EPS d SLMs d splitters 




FIG. 2. (Color online) Schematic diagram for a deterministic implementation of the proposed QKD scheme (a) Suggested preparation of the 
source state using an array of single-entangled-photon-pair sources (EPS), spatial light modulators (SLMs), splitters, and 0AM combiners, 
(b) Suggested measurement setup for Alice (Bob). Measurements 1, 2, and 3, i.e., Aj and (j, k= 1,2,3) are respectively selected randomly 
(e.g., using beam splitters) on Alice’s and Bob’s side. For the Bell test, Alice (Bob) sets the half-wave plate (HWP3) orientation angle to 
implement the randomly chosen measurement. HWP3 and PBS6 are used for polarization analysis in the Bell-test. As in Fig.^ 0AM sorting 
is used to resolve the qubit subspaces and/or establish the key. 


SLM2 and PBS4), and then carrying out 0AM detection. We 
define the operations to reverse Qa/b^^ 

d 

= £ |2n,7/)^(2«,//U + |2«,y)^(2«+l,VU (19) 

n=\ 

d 

n=\ 

Since the state within the ^th subspace [Eq. is maximally 
entangled, it gives a maximal violation of the CHSH inequal¬ 
ity based on operator 

Sn{\<l>)n (0IJ = Tr(5„ \(j>)„ (0|„) = 2V2 > 2. (20) 


2. Measurement: Deterministic case 


When t he state is prepared deterministically as described 
in Section 


III A 2 


operators 2^ ^ and 2^ ^ [Eqs. in and 
( p^ ] are not necessary for the measurements. As in the non- 
deterministic case, the Bell test is carried out using a combi¬ 
nation of a HWP and PBS [see Pig. [^(b)], but photon num¬ 
ber resolution and final postselection are not required. Due 
to the difference in basis assignment in this case, we redefine 
the detector settings for the CHSH Bell inequality violation as 
measurements in the bases {|m+(0))', |m_(0))'}, where 


|m+(0))' = — co^{2Q)\n^H) -bsin(20)|^,y), 
|m_(0))' =sin(20)|^,Ff) +cos(20)|^,y). (21) 


The optimum settings (specified by 0) for the HWP are the 
same as in Eq. above, and the resulting Bell operator for 


this case [see Eq. Oi is 

S„ =V2{ + IVAABYn {VAMn 

+ \Ha,HB y„{VA,VB\'n + \yA, ^BYn {^A^Hb^ 

- {haAbI - \yA,HBy, {va,hbI 

+ , Vb)! (Va, 1 : + , //b)' (/^4, Vb D. (22) 

The state represented by Eq. ( p^ is also maximally entan¬ 
gled within the ^th subspace for this case, and it gives a max¬ 
imal violation of the CHSH inequality based on operator ( [22| ) 
when the key has not been eavesdropped. 


C. Security against collective attacks 

Any eavesdropping of the key is essentially a measurement 
strategy that will destroy polarisation entanglement which is 
used to establish the key. This in turn degrades the CHSH Bell 
inequality violation m in any respective 0AM subspaces. A 
collective attack is one in which the eavesdropper (Eve) ap¬ 
plies the same operation on each of Alice’s and Bob’s parti¬ 
cles, but has no other limitations. In particular, she is allowed 
to have access to a string of qubits from Alice/Bob at one time, 
and to other dimensions of their particle states, even possibly 
unknown to Alice/Bob. Since Eq. 0 is a product state of d 
entangled qubits pairs, our scheme is essentially a multiplex¬ 
ing of multiple polarisation-entangled qubit pairs by means 
of a higher-dimensional degree of freedom, followed by inde¬ 
pendently testing the CHSH Bell inequality simultaneously— 
Eve’s access to one or more source states in our scheme is 
equivalent to her access to a string of qubits on which she 
can perform joint (coherent) measurements. Therefore, the 
security of our scheme is completely guaranteed by the se¬ 
curity of the individual qubit-based schemes against collec¬ 
tive attacks csi. This, in turn, implies security against the 
most general, so-called coherent attacks (Tbl if an ap¬ 
plication of the exponential quantum de Finetti theorem can 
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FIG. 3. (Color online) Comparison of the minimum secure key rate 
r^nin as a function of the Bell parameter S and the quantum bit-error 
rate (QBER) g, in a single run, for our scheme with a qubit-based 
E91-type protocol ifTTlfTSl . We assume that the quantum bit error 
rate Q and Bell parameter for each channel is the same, i.e., Qn = 
g, and Sn = S respectively for all n. Our scheme shows a J-fold 
enhancement in secure key rate. 


be made ioi. This is indeed the case in our scheme (un¬ 
der the assumption of finite-dimensional subsystems) because 
our source state is invariant under permutation of Alice and 
Bob, and their measurement outcomes are commutative, as 
mentioned above [Eq. inn- These results apply fully to our 
large-alphabet protocol since it is equivalent to simultaneous 
but independent 2-qubit secure protocols. The total bit rate 
generated securely against collective attacks as a function of 
Bell parameters Sn can therefore be written as mi 

+ (23) 

where h is the binary entropy and Qn is the quantum bit er¬ 
ror rate for channel n. As shown in Fig. the larger the 
measured Bell violation, the higher the secure key rate per 
run. Our scheme gives a J-fold enhancement over the tradi¬ 
tional 2-qubit schemes as a large-alphabet scheme, but uses 
a much simplified Bell-test measurement setup compared to 
traditional large-alphabet schemes. 

The implications of loopholes for QKD based on Bell’s 
theorem is worthy of some mention here. Closing the local¬ 
ity loophole in general requires enforcing a space-like sep¬ 
aration between Alice and Bob as required for testing non¬ 
locality ED, but in the context of our QKD scheme, it would 
be sufficient to guarantee that no quantum signals can travel 
from Alice to Bob by ensuring proper isolation of Alice’s and 
Bob’s locations (HI. Also, a proper closure of the detection 
loophole is required for completely guaranteed security. This 
seems promising as it has already been achieved in a photon- 
based Bell-test experiment (421. 


IV. CONCLUSION 


Our scheme offers significant advantages over current gen¬ 
eralised E91 schemes. It results in a greatly simplified secu¬ 
rity verification and key generation setup which does not get 
more complicated with increasing J, except for an increase 
in the number of output ports of the 0AM sorting device. It 
thereby provides a route to boosting the secure key rates in 
entanglement-based QKD without the usual increased com¬ 
plexity of Bell tests in high dimensions. It also benefits from 
the relative tolerance two-dimensional Bell tests to measure¬ 
ment error. Although it is known that the amount of viola¬ 
tion for an actual D-dimensional Bell test increases with D, 
these increments are marginal even in the ideal case, and level 
off as D increases (JHIISI- Also, the high sensitivity of the 
complicated measurement setup to errors will usually over¬ 
whelm these increments even for modest values of D, result¬ 
ing in smaller violations than in the qubit case. Another ad¬ 
vantage of our scheme where an SPDC source is used is that 
non-maximal high-dimensional entanglement will not gener¬ 
ally degrade the the verification of security. For example, the 
spiral bandwidth (44l of the SPDC source will not generally 
degrade Bell violation, but will only limit the effective number 
of 0AM channels in the non-deterministic case. Whereas, if 
generalised OAM-based Bell tests are used without procrus- 
trean filtering, then a small spiral bandwidth might cause a 
failure of the Bell test for an entangled state (H. 

In summary, this paper has described a practical scheme 
in which a single CHSH-Bell test setup combined with a full 
projective measurement is sufficient for security verification 
even for a large-alphabet scheme capable of arbitrarily large 
key rates per run. The scheme is simpler to implement than 
existing generalizations of E91 protocol to high-dimensions 
because it circumvents measurements in mutually unbiased 
bases in high dimensions, while maintaining capacity for large 
key-rate and security against collective attacks. A second sig¬ 
nificant advantage is that non-maximal high-dimensional en¬ 
tanglement will not necessarily degrade the verification of se¬ 
curity. We point out that the scheme is realisable using current 
technology by mentioning two examples for generating ap¬ 
plicable source states, namely, spontaneous parametric down- 
conversion and, more suitably, source of single pairs of entan¬ 
gled photons, such as semiconductor quantum dots. From the 
point of view of real-world applications of high-dimensional 
QKD based on photon 0AM in free space, judicious selection 
of basis states (45l [46l will increase resilience against deco¬ 
herence induced by atmospheric turbulence in a free space im¬ 
plementation. Although this can be applied within the frame¬ 
work of this scheme, implementations with time bins |[T0ll47l 
or path appear especially promising for long distance appli¬ 
cations. The complexity of security verification in large- 
alphabet entanglement-based QKD makes it apparent that the 
simplified scheme presented here will likely enable otherwise 
infeasible secure key rates in QKD, enabling more practical 
implementations of entanglement-based technologies. 
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